Add chezmoi update command

[shunk031]

Summary

• add chezmoi-update for public/private source updates and apply
• use chezmoi git -- with fast-forward-only updates
• add Bats coverage for target selection, safety checks, token handling, and fast-forward behavior

Tests

• bash -n home/dot_local/bin/exact_common/executable_chezmoi-update
• shfmt -i 4 -sr -d home/dot_local/bin/exact_common/executable_chezmoi-update tests/install/common/chezmoi_update.bats
• shellcheck home/dot_local/bin/exact_common/executable_chezmoi-update tests/install/common/chezmoi_update.bats
• stub-based smoke tests for up-to-date and local-ahead behavior

Note: Bats was not run locally per repository policy.

[codecov]

Codecov Report

❌ Patch coverage is 94.36620% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.81%. Comparing base (f854ee5) to head (6b7a355).

Files with missing lines	Patch %	Lines
...t_local/bin/exact_common/executable_chezmoi-update	94.36%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #473      +/-   ##
==========================================
+ Coverage   88.98%   90.81%   +1.83%     
==========================================
  Files           9       10       +1     
  Lines         236      305      +69     
==========================================
+ Hits          210      277      +67     
- Misses         26       28       +2     

Flag	Coverage Δ
macos-14-client	41.66% <ø> (ø)
ubuntu-latest-client	90.49% <94.36%> (+1.55%)	⬆️
ubuntu-latest-server	90.49% <94.36%> (+1.55%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.